Status: PASS / LIVE_CANDIDATE / PROVIDER_UNBOUND / PRODUCTION_NO_GO

V2 closes the trust gap in V1 where a caller could supply an arbitrary authorizer_receipt_sha256. Deployment planning now accepts only a complete signed consumption receipt from the dedicated R2 authorizer V2 and verifies it offline.

Required authorizer:

DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS

Receipt schema:

rumbo-r2-dedicated-authorizer-consumption/v2

Algorithm:

ES256 / ECDSA P-256 + SHA-256

Pinned signing key id:

bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY

Only the public verification JWK is embedded in the deployer.

POST /v2/prepare verifies:

• exact receipt schema;
• repository identity;
• PR number;
• Git base/head SHA syntax;
• sealed control-package SHA-256;
• evidence and request SHA-256;
• consumed timestamp;
• exact production-go false;
• exact action/merge-authorized consistency;
• receipt SHA-256 recomputation;
• signing algorithm and key id;
• ES256 signature under the pinned public key.

The plan is derived from the verified receipt rather than duplicate caller-supplied binding fields.

V1 unsigned endpoints are retired with HTTP 410.

A cryptographically valid TEST_ONLY receipt may be stored as a non-executable evidence plan, but POST /v2/execute rejects it with:

AUTHORIZER_ACTION_NOT_MERGE_PR

before checking the deployment enable flag.

For an executable path, all of the following would be required:

1. signed authorizer action MERGE_PR;
2. signed merge_authorized=true;
3. receipt age <= 900 seconds;
4. R2_ALLOW_DEPLOY=true;
5. a dedicated GitHub App provider credential;
6. a provider adapter.

The current runtime fails closed before those conditions:

• deploy enabled: false;
• GitHub App credential: absent;
• provider adapter: NOT_BOUND;
• production_go: false.

Branch evaluation:

01a04ba9-dcc8-767a-9cae-18783c6e0100

Result: PASS.

Matrix:

• health → 200;
• pinned signed fixture verifies → true;
• tampered local fixture verifies → false;
• unauthenticated ledger → 401;
• V1 unsigned endpoint → 410;
• tampered signed receipt admission → 400;
• forged TEST_ONLY→MERGE_PR elevation → 400;
• unsigned V1 receipt admission → 400;
• valid signed TEST_ONLY prepare → 201;
• execute TEST_ONLY plan → 403;
• duplicate prepare → 409;
• ledger → 200;
• signature bytes exposed by ledger → false;
• audit → 200;
• audit chain valid → true.

Fixture authorizer receipt SHA-256:

e493623c38a1028e7263311300cb558cc8b69665a718ae9c0845a78e9b03602b

The deployer controller now independently authenticates authorizer receipts. This closes receipt authenticity and action-escalation gaps between authorization custody and deployment planning.

Actual provider execution is still not live and remains impossible under current gates. No merge, deployment or product-production authorization is implied.